Touchstone provides diagnostic medical imaging services in multiple states, including Nebraska, Texas, Colorado, Florida, and Arkansas. In May 2014, OCR received an email that alleged the Social Security numbers of Touchstone’s patients were available online through an insecure file transfer protocol web server. Touchstone learned of the insecure web server the same day OCR was notified. OCR initially investigated the allegation within a few days and discovered that PHI, including Social Security numbers, was visible through a Google search. Following a full investigation, OCR determined that names, dates of births, phone numbers, and addresses of over 300,000 patients had been accessible to the public through the insecure web server. Some patients’ Social Security numbers were also released. In addition, OCR discovered that Touchstone failed to enter into required business associate agreements, failed to conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic PHI, and failed to notify affected individuals and media outlets of the breach in a timely manner.

As a result of the Resolution Agreement and Corrective Action Plan, Touchstone must pay $3 million in penalties to HHS and adhere to a Corrective Action Plan that requires it to:

conduct an accounting of its business associates and provide HHS with its business associate agreements within 60 days;

complete an analysis of security risks and vulnerabilities that incorporates all electronic equipment, data systems, programs, and applications of Touchstone or its affiliates that contain, store, transmit, or receive Touchstone e-PHI and submit the analysis to HHS for its approval;

review and revise its written policies to comply with the Privacy, Security, and Breach Notification Rules and submit the policies to HHS for its approval;

distribute its policies and procedures to its entire workforce, and to new workers within their first 14 days, and require new workers to sign a certification form stating they have read, understood, and will abide by the policies and procedures;

prepare and submit to HHS for its approval proposed training materials for Touchstone’s workforce and provide training to all members of its workforce and new workers within their first 14 days of work; and

submit to HHS an annual report that includes the company’s status in complying with the Corrective Action Plan, an updated accounting of business associates, a copy of all training materials, and verification that all members of the workforce have received the necessary training.

OCR announced this settlement just one week after HHS announced that it will lower the maximum penalties it will assess for some HIPAA violations. Although the Touchstone Resolution Agreement was negotiated before the new limits took effect, it seems unlikely that the new guidelines would have lowered the penalty in this case. Under the new guidelines, the maximum amount for the most serious HIPAA violations remains unchanged at $1.5 million per type of violation per year. Given the OCR’s findings in this case—in particular that the breach came to light only after a third party reported it and that Touchstone failed to timely notify affected individuals of the breach—it seems likely that OCR would have placed this violation within the most serious category of violations in determining how much to assess. Thus, the Touchstone settlement reminds us that, notwithstanding the new guidelines, significant, uncorrected violations may still result in large monetary penalties and close monitoring from HHS.

Ballard Spahr attorneys established the Health Care Reform Dashboard as a one-stop resource under the Affordable Care Act. We have expanded the scope of the Dashboard to extend to certain other laws, but continue the mission of providing our readers with information about significant changes affecting health care and health benefits in the United States and to establish a repository for analysis and original source material of significant developments that have occurred over time. Change is ongoing, and we will continue to update the Dashboard to reflect new legislation, administrative guidance, and judicial decisions as they are published.

]]>HHS Decreases Maximum HIPAA Penaltieshttps://www.healthcarereformdashboard.com/2019/05/hhs-decreases-maximum-hipaa-penalties/
Fri, 03 May 2019 13:51:42 +0000https://www.healthcarereformdashboard.com/?p=2413Continue Reading »]]>The Department of Health and Human Services has announced that it is lowering the maximum amount it will assess for most types of HIPAA violations. Although the change is couched as an exercise of discretion, HHS states that it is basing the modifications on a change in its interpretation of the penalty provisions set forth in the Health Information Technology for Economic and Clinical Health Act (HITECH) Act.

As revised, the maximum annual penalty that HHS will assess for any type of HIPAA violation will vary with the entity’s culpability. Previously, this variation applied only to the minimum penalty for each particular violation.

Civil Monetary Penalties

Nature of Offence

Prior Penalty Limits

New Penalty Limits

Did not know and by exercising reasonable diligence would not have known of violation

$100 to $50,000 per violation

Up to $1.5 million per type per year

$100 to $50,000 per violation

Up to $25,000 per type per year

Violation due to reasonable cause

$1,000 to $50,000 per violation

Up to $1.5 million per type per year

$1,000 to $50,000 per violation

Up to $100,000 per type per year

Willful neglect but corrected problem

$10,000 to $50,000 per violation

Up to $1.5 million per type per year

$10,000 to $50,000 per violation

Up to $250,000 per type per year

Willful neglect but did not correct problem

$50,000 per violation

Up to $1.5 million per type per year

$50,000 per violation

Up to $1.5 million per type per year

The practical effect of these modifications will depend on the extent to which HHS seeks to impose penalties on covered entities and business associates for offenses that did not result from willful neglect and that have not been appropriately corrected. The change in penalties does not alter the basic advice to health care providers and health plans: continue to maintain appropriate safeguards against violations of HIPAA’s privacy and security rules and take prompt action in the event of a breach.

Ballard Spahr attorneys established the Health Care Reform Dashboard as a one-stop resource under the Affordable Care Act. We have expanded the scope of the Dashboard to extend to certain other laws, but continue the mission of providing our readers with information about significant changes affecting health care and health benefits in the United States and to establish a repository for analysis and original source material of significant developments that have occurred over time. Change is ongoing, and we will continue to update the Dashboard to reflect new legislation, administrative guidance, and judicial decisions as they are published.

]]>HIPAA Enforcement Outlook for 2019 and Beyondhttps://www.healthcarereformdashboard.com/2019/04/hipaa-enforcement-outlook-for-2019-and-beyond/
Thu, 18 Apr 2019 18:44:24 +0000https://www.healthcarereformdashboard.com/?p=2406Continue Reading »]]>After announcing that its HIPAA enforcement collections had reached a new high-water mark of $28.7 million in 2018, the Office of Civil Rights (OCR) of the U.S. Department of Health and Human Services has started this year quietly. Through the first few months of 2019, the OCR has published no resolution agreements and it is doubtful that it has any investigation in the pipeline that will produce a settlement nearly as large as the $16 million collected from Anthem, Inc., last year on account of its massive data breach in 2014 and 2015, which affected almost 79 million people. Thus, it appears unlikely that this year’s OCR collections will match the totals from 2018, but a number of factors suggest that enforcement activity will resume and potentially expand in the future. For example:

Settlement payments may provide the government with needed revenue in a period of budgetary constraints.

OCR announced last year that it would develop a methodology for distributing a portion of the money it receives through HIPAA enforcement actions to individuals affected by a breach. The implementation of such a program (which is technically required, but long delayed) may encourage more individuals to report breaches to OCR and could motivate OCR to increase the amount it seeks in any given enforcement action.

Although there is no private right of action under HIPAA, individuals may bring lawsuits under other privacy grounds and legal theories, which nevertheless draw on HIPAA to set standards for how data should be protected.

As for settlements, there has been little recent activity on OCR’s HIPAA audit program. Phase Two of the audit program seems to have fizzled out. Although audits may be revived at some time in the future, it is more likely that OCR will dedicate its limited HIPAA resources to investigations—which can produce revenue in addition to requiring corrective actions, and sometimes spark others to undertake compliance activity—rather than audits that focus exclusively on improving compliance.

However, investigations take a long time to develop. The enforcement actions that may come to fruition this year probably originated three to five years ago, and we may not see the results of increased enforcement activity today for several more years.

Ballard Spahr attorneys established the Health Care Reform Dashboard as a one-stop resource under the Affordable Care Act. We have expanded the scope of the Dashboard to extend to certain other laws, but continue the mission of providing our readers with information about significant changes affecting health care and health benefits in the United States and to establish a repository for analysis and original source material of significant developments that have occurred over time. Change is ongoing, and we will continue to update the Dashboard to reflect new legislation, administrative guidance, and judicial decisions as they are published.

]]>Association Health Plan Regulations Invalidatedhttps://www.healthcarereformdashboard.com/2019/04/association-health-plan-regulations-invalidated/
Mon, 01 Apr 2019 12:33:23 +0000https://www.healthcarereformdashboard.com/?p=2398Continue Reading »]]>The U.S. District Court for the District of Columbia has set aside the most significant portions of the U.S. Department of Labor’s (DOL) regulations on Association Health Plans (AHPs). The court’s ruling invalidates regulatory provisions that sought to broaden the groups of employers that could be treated as if they were a single employer, allowing them to establish health plans that did not need to meet certain Affordable Care Act (ACA) requirements. The ruling will very likely be appealed, but may—at least temporarily—dampen interest in AHPs, particularly among groups of employers that are loosely affiliated.

Although the court characterized the regulations as an “end-run around the ACA,” the decision is grounded mostly in the Employee Retirement Income Security Act (ERISA). The regulations themselves sought to expand the scope of AHPs by amending ERISA’s definition of “employer.” That definition includes an association of employers acting in the interest of those employers in relation to an employee benefit plan. While giving deference to the DOL’s authority to interpret ERISA, the court found the new regulations to be unreasonable in view of ERISA’s focus on benefit arrangements that arise in the context of an employment relationship.

The court found that the new regulations did not adequately distinguish AHPs from commercial insurance arrangements. Specifically, it ruled that:

Although the regulations formally required associations to have a substantial purpose beyond the establishment of a health plan, the regulations recognized purposes with little substance, such as the issuance of a newsletter.

The regulatory provisions inappropriately recognized employers in the same state or metropolitan area as having a commonality of interest, when such geographic connections often do not create much of a connection among employers.

Sole proprietors, which are not considered to be employers under ERISA on their own, do not become employers simply by associating with other sole proprietors or organizations that employ individuals.

The ACA remains a battleground with various states filing lawsuits to stop Trump administration efforts to cut back ACA programs and their effect, while other states seek to overturn the ACA completely. Last week saw two other developments as the Trump administration fully aligned its position with those states that claim that the ACA should be overturned in its entirety as unconstitutional, and the D.C. District Court found that the state of Arkansas could not require individuals to meet a work requirement to qualify for Medicaid—which the state had previously elected to expand under the ACA.

Ballard Spahr attorneys established the Health Care Reform Dashboard as a one-stop resource under the ACA. We have expanded the scope of the Dashboard to extend to certain other laws, but continue the mission of providing our readers with information about significant changes affecting health care and health benefits in the United States and to establish a repository for analysis and original source material of significant developments that have occurred over time. Change is ongoing, and we will continue to update the Dashboard to reflect new legislation, administrative guidance, and judicial decisions as they are published.

A relatively quiet year for HIPAA enforcement is ending with a small flourish. The Office of Civil Rights of the Department of Health and Human Services (HHS) has announced two settlements with covered entities within the span of eight days.

The first settlement involved Advanced Care Hospitalists (ACH), a company that provides internal medicine physicians to hospitals and nursing homes in Florida. In 2014, ACH received notice from a local hospital that individually identifiable patient information had been posted on the website of a third party billing provider. ACH reported the breach, which ultimately led to an HHS investigation. HHS found that:

The disclosure affected 9,225 patients.

ACH failed to enter into a business associate agreement with one or more vendors who had access to protected health information (PHI).

ACH did not implement privacy, security, or breach notification policies and procedures until after the breach was discovered.

ACH failed to conduct a security risk analysis until after the breach was discovered.

To settle these matters, ACH agreed to pay a $500,000 penalty and fulfill its obligations under a supervised corrective action plan that focuses on the identified failures.

The second settlement followed from a complaint lodged with HHS against Pagosa Springs Medical Center (PSMC) in Colorado. The ensuing investigation revealed:

· The impermissible disclosure of the PHI of at least 557 individuals to a former employee whose access to PSMC’s information systems was not revoked upon termination of employment.

· The impermissible disclosure of the PHI of at least 557 individuals to a business associate without an appropriate business associate agreement.

The settlement agreement requires PSMC to pay a penalty of $111,400 and meet its obligations under a corrective action plan that addresses the identified failures and additional matters, including a security risk analysis, security management, and training.

The penalties imposed in these two settlements seem small compared to many settlements that we have seen in recent years. The settlement agreements do not present enough facts to explain the settlement amounts. For PSMC, we do not know whether the former employee or the business associate that impermissibly received PHI did anything that further exposed the PHI that they received. The ACH matter is different. It involved many more individuals and a disclosure that clearly went beyond a single individual or entity. In ACH’s favor, it is not clear who would have had access to the website where the PHI was posted, and ACH did, on its own, notify HHS of the breach and take certain corrective actions.

The two settlements remind us that HIPAA compliance beats HIPAA complacence. HIPAA enforcement can have a long life. The two settlements relate to incidents that occurred four or five years ago. It may not be possible to undo errors of the past, but changes after the fact can still protect against future breaches and could help reduce penalties if an investigation of past violations does occur.

Ballard Spahr attorneys established the Health Care Reform Dashboard as a one-stop resource under the Affordable Care Act. We have expanded the scope of the Dashboard to extend to certain other laws, but continue the mission of providing our readers with information about significant changes affecting health care and health benefits in the United States and to establish a repository for analysis and original source material of significant developments that have occurred over time. Change is ongoing, and we will continue to update the Dashboard to reflect new legislation, administrative guidance, and judicial decisions as they are published.

The Equal Employment Opportunity Commission (EEOC) has formally withdrawn the provisions in its regulations governing wellness programs under the Americans with Disabilities Act (ADA) and the Genetic Information Nondiscrimination Act (GINA), which set limits on the amount of incentives for participation in a wellness program. This withdrawal aligns the regulations with a court order that would have vacated the provisions effective January 1, 2019.

In AARP v. EEOC, the U.S. District Court for the District of Columbia found that the EEOC had not adequately justified the limits set forth in the regulations. The remainder of the EEOC guidance on wellness programs under the ADA and GINA continues to be in effect. With the withdrawal of these provisions, employers are left without guidance on the amount that they can set as a wellness program incentive under these two statutes.

The choice to participate in the wellness program and disclose personal medical information needs to be voluntary. The question is, when does the incentive become so large that the decision ceases to be voluntary? Employers that have not already examined their wellness program incentives in view of the court order may wish to review them now, but there is likely more to come on this issue. The EEOC is expected to reconsider wellness incentive limits in the coming year.

Ballard Spahr attorneys established the Health Care Reform Dashboard as a one-stop resource under the Affordable Care Act. We have expanded the scope of the Dashboard to extend to certain other laws, but continue the mission of providing our readers with information about significant changes affecting health care and health benefits in the United States and to establish a repository for analysis and original source material of significant developments that have occurred over time. Change is ongoing, and we will continue to update the Dashboard to reflect new legislation, administrative guidance, and judicial decisions as they are published.

The Affordable Care Act returned to the front page this weekend when a federal district court in Texas issued an opinion striking down the entire law as unconstitutional.

The case arose from a lawsuit filed by a contingent of Republican state attorneys general, one governor, and a few individuals. They asserted that Congress’s elimination of the tax penalty under the ACA individual mandate provision, part of last year’s Tax Cuts and Jobs Act, rendered the entire ACA unconstitutional. Little immediate effect is expected—the court did not issue an injunction—but if upheld, the decision’s eventual effects on U.S. health care will be monumental.

The individual mandate requires taxpayers to obtain health coverage for themselves and their families. Failure to do so results in assessments under the Internal Revenue Code. The Tax Cuts and Jobs Act did not eliminate the individual mandate rules altogether, but did (effective January 1, 2019) reduce the tax consequences of failing to obtain coverage to zero dollars. In 2012, the U.S. Supreme Court upheld the constitutionality of the individual mandate based on Congress’s taxing power. With the elimination of the tax penalty, the court found that the individual mandate no longer constitutes an exercise of Congress’s tax power, and is, therefore, unconstitutional. Finding further that the individual mandate is essential to the ACA as a whole, the court struck down the entire Act.

If the trial court’s ruling is upheld by the appellate courts, the ACA insurance market reforms that prohibit pre-existing condition exclusions, guarantee continued issue of insurance, require coverage for children through their parents’ coverage until age 26, and assure minimum essential benefits, including preventive health benefits without copayments, will no longer be required. Many of the Marketplace health insurance exchanges, all of the premium subsidies for lower income families enrolled for coverage in the Marketplace Exchanges, and extended Medicaid coverage provisions would also be eliminated.

The court’s ruling is expected to have little immediate effect. The court did not issue an injunction, and the Trump administration has asserted that it will continue to enforce the terms of the ACA pending appeal, notwithstanding its vocal opposition to the law. The administration’s unwillingness to defend the individual mandate in the lawsuit led a number of attorneys general, from states more supportive of the ACA, to intervene. They are certain to appeal the ruling and may be joined by the House of Representatives when Democrats become the majority party in January.

The decision has far-reaching political consequences. It was a major issue in last month’s federal mid-term elections and a significant issue in state elections as well. States have increasingly needed to take positions on ACA-related issues. Besides determining whether to join one side or the other of this lawsuit (nearly two-thirds of states are now involved) and ongoing questions about the role to play in health insurance exchanges, many states are faced with determining the extent to which they will support association health plans and short-term, limited duration insurance, whether they will expand Medicaid coverage, and whether they will seek waivers of ACA requirements. If courts ultimately strike down the ACA, the burden of addressing health care and how to pay for it will likely fall even more heavily on the states.

Before that occurs, the litigants in the case will be sharpening their arguments for appeal to the Fifth Circuit Court of Appeals and potentially the Supreme Court, where two new justices now sit. Because these justices replace two who previously voted to strike down the ACA as unconstitutional, attention may once again focus on Chief Justice Roberts, who previously authored the opinion that upheld the constitutionality of the individual mandate and the ACA.

Ballard Spahr attorneys established the Health Care Reform Initiative to monitor and analyze legislative and regulatory developments in health care reform. We will continue to follow developments in this area as they emerge. Our Health Care Reform Dashboard serves as an ongoing online resource center for news and analysis on developments regarding the ACA and health care reforms that follow.

]]>IRS Extends ACA Reporting Deadline Again This Yearhttps://www.healthcarereformdashboard.com/2018/12/irs-extends-aca-reporting-deadline-again-this-year/
Mon, 03 Dec 2018 13:18:54 +0000https://www.healthcarereformdashboard.com/?p=2374Continue Reading »]]>For the third consecutive year, the IRS has extended by 30 days the deadline for health plan sponsors to furnish Forms 1095-B and 1095-C to individuals. A 30-day extension would place the deadline on a Saturday, so this year’s reprieve will allow employers, health insurers, and other plan sponsors to distribute the forms on or before March 4, 2019, rather than January 31.

The new guidance does not extend the deadlines for submitting the forms, along with Forms 1094-C and 1094-B, to the IRS. Those deadlines remain February 28, 2019, for paper forms and March 31, 2019, for electronic filings. Those submitting paper forms should take note that the IRS filing deadline precedes the date for providing the forms to individuals.

Also following prior years’ guidance, the IRS has extended good-faith relief to filers who submit incomplete or incorrect information in their 2018 Forms 1094 and 1095. To qualify for this relief, the reporting entity must show that it made good-faith efforts to comply with requirements. However, this relief does not cover a missed deadline for reporting.

Employers should be prepared to respond to inquiries about coverage from employees who are filing their tax returns for 2018 early and may wish to keep in mind that the legislative repeal of the individual mandate assessments under the ACA does not take effect until 2019.

Ballard Spahr attorneys established the Health Care Reform Initiative to monitor and analyze legislative and regulatory developments in health care reform. We will continue to follow developments in this area as they emerge. Our Health Care Reform Dashboard serves as an ongoing online resource center for news and analysis on developments regarding the ACA and health care reforms that follow.

Attorneys in Ballard Spahr’s Employee Benefits and Executive Compensation Group help clients design and implement compensation and benefits packages that comply with today’s complex regulatory requirements, attract and retain a quality workforce, and maintain fiscal and fiduciary responsibility. Attorneys in Ballard Spahr’s Health Care Group represent clients across the health care industry and counsel clients on health care, benefits, and tax regulatory and compliance issues, as well as privacy and data security, transactional, financing, benefits and compensation, and labor and employment matters.

The new guidance addresses a number of concerns under the employer mandate, particularly regarding HRAs designed (at least in part) to purchase health coverage in the individual market (“individual coverage HRAs”):

The employer mandate standard is met if a group health plan satisfies two tests. An employer that funds an HRA meets the first test—the one most likely to result in large penalties—if the HRA is made available to at least 95% of its full-time employees and their dependents.

Under the second test, an employer will need to pay an assessment based on the number of full-time employees that receive a premium tax credit in purchasing coverage on a public health insurance exchange. An employee would not be eligible for a premium tax credit if the employee is offered HRA coverage that provides affordable minimum value coverage.

An individual coverage HRA will be affordable based on how much the employee would need to contribute (as a percentage of compensation) for self-only coverage in the lowest cost silver plan available to the employee after taking into account the amount available through the HRA.

The guidance identifies certain safe harbors and other rules that may simplify the calculation of affordability.

As provided in the proposed regulations, an individual coverage HRA will provide minimum value as long as it is affordable, with our without application of the new safe harbors.

It is worth keeping in mind that the employer mandate applies only to employers with at least 50 full-time employees or full-time equivalents. Small employers that implement individual coverage HRAs would not be subject to these rules.

Self-funded Health Plan Nondiscrimination Rules

Section 105(h) of the Internal Revenue Code prohibits self-funded health plans from offering a benefit to any highly compensated participant that it does not also offer to every non-highly compensated participant. The proposed HRA regulations allow individual coverage HRAs to differentiate among specified classes of employees. The new guidance provides that future rules will allow employers to contribute different amounts to HRAs for different classes of employees. However, the classes will be limited to those specified in the proposed regulations. The contributions within a class must be the same for all class members with one exception: Contributions for older employees may increase with the cost of individual insurance in the relevant market based on age.

It is important to note that the nondiscrimination rules under section 105(h) of the Code do not apply to an HRA that reimburses only individual health insurance premiums. For the nondiscrimination rules to apply, the HRA will need to be available to reimburse other expenses.

Comments on the new guidance are due December 28.

Ballard Spahr attorneys established the Health Care Reform Dashboard as a one-stop resource under the Affordable Care Act. We have expanded the scope of the Dashboard to extend to certain other laws, but continue the mission of providing our readers with information about significant changes affecting health care and health benefits in the United States and to establish a repository for analysis and original source material of significant developments that have occurred over time. Change is ongoing, and we will continue to update the Dashboard to reflect new legislation, administrative guidance, and judicial decisions as they are published.

The new guidance addresses a number of concerns under the employer mandate, particularly regarding HRAs designed (at least in part) to purchase health coverage in the individual market (“individual coverage HRAs”):

The employer mandate standard is met if a group health plan satisfies two tests. An employer that funds an HRA meets the first test—the one most likely to result in large penalties—if the HRA is made available to at least 95% of its full-time employees and their dependents.

Under the second test, an employer will need to pay an assessment based on the number of full-time employees that receive a premium tax credit in purchasing coverage on a public health insurance exchange. An employee would not be eligible for a premium tax credit if the employee is offered HRA coverage that provides affordable minimum value coverage.

An individual coverage HRA will be affordable based on how much the employee would need to contribute (as a percentage of compensation) for self-only coverage in the lowest cost silver plan available to the employee after taking into account the amount available through the HRA.

The guidance identifies certain safe harbors and other rules that may simplify the calculation of affordability.

As provided in the proposed regulations, an individual coverage HRA will provide minimum value as long as it is affordable, with our without application of the new safe harbors.

It is worth keeping in mind that the employer mandate applies only to employers with at least 50 full-time employees or full-time equivalents. Small employers that implement individual coverage HRAs would not be subject to these rules.

Self-funded Health Plan Nondiscrimination Rules

Section 105(h) of the Internal Revenue Code prohibits self-funded health plans from offering a benefit to any highly compensated participant that it does not also offer to every non-highly compensated participant. The proposed HRA regulations allow individual coverage HRAs to differentiate among specified classes of employees. The new guidance provides that future rules will allow employers to contribute different amounts to HRAs for different classes of employees. However, the classes will be limited to those specified in the proposed regulations. The contributions within a class must be the same for all class members with one exception: Contributions for older employees may increase with the cost of individual insurance in the relevant market based on age.

It is important to note that the nondiscrimination rules under section 105(h) of the Code do not apply to an HRA that reimburses only individual health insurance premiums. For the nondiscrimination rules to apply, the HRA will need to be available to reimburse other expenses.

Comments on the new guidance are due December 28.

Ballard Spahr attorneys established the Health Care Reform Dashboard as a one-stop resource under the Affordable Care Act. We have expanded the scope of the Dashboard to extend to certain other laws, but continue the mission of providing our readers with information about significant changes affecting health care and health benefits in the United States and to establish a repository for analysis and original source material of significant developments that have occurred over time. Change is ongoing, and we will continue to update the Dashboard to reflect new legislation, administrative guidance, and judicial decisions as they are published.